CVE-2026-89995
Last modified
CVE-2026-89995 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dma_direct_alloc_from_pool() Commit 5b138c534fda ("dma-direct: factor out a dma_direct_alloc_from_pool helper") changed dma_direct_alloc_from_pool() to return the CPU address from dma_alloc_from_pool(). That fits dma_direct_alloc(), but dma_direct_alloc_pages() also uses the helper and expects a struct page *. Fix this by making dma_direct_alloc_from_pool() return the struct page * again, and pass the CPU address back through an out-parameter for the dma_direct_alloc() caller..
Description
In the Linux kernel, the following vulnerability has been resolved: dma-direct: return struct page from dma_direct_alloc_from_pool() Commit 5b138c534fda ("dma-direct: factor out a dma_direct_alloc_from_pool helper") changed dma_direct_alloc_from_pool() to return the CPU address from dma_alloc_from_pool(). That fits dma_direct_alloc(), but dma_direct_alloc_pages() also uses the helper and expects a struct page *. Fix this by making dma_direct_alloc_from_pool() return the struct page * again, and pass the CPU address back through an out-parameter for the dma_direct_alloc() caller.
Metrics
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 5b138c534fda57c2ebc1e6de72578aa1d70788a6, < c3fdb94da43ff23287f85664174c45c45e881a3f; >= 5b138c534fda57c2ebc1e6de72578aa1d70788a6, < 408ff2d5bf555bd3f4c84a2edb95c0690bf9edc8; >= 5b138c534fda57c2ebc1e6de72578aa1d70788a6, < feeb2ef775081a6c188cdd10e7a45369a07ce531; >= 5b138c534fda57c2ebc1e6de72578aa1d70788a6, < 94a04ad732c9f8b9554270fc4038a06737de5c22 |
| Linux | Linux | 5.10 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-89995?
How severe is CVE-2026-89995?
How do I fix CVE-2026-89995?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-89989In the Linux kernel, the following vulnerability has been re…
- CVE-2026-89990In the Linux kernel, the following vulnerability has been re…9.8
- CVE-2026-89991In the Linux kernel, the following vulnerability has been re…
- CVE-2026-89992In the Linux kernel, the following vulnerability has been re…8.4
- CVE-2026-89993In the Linux kernel, the following vulnerability has been re…
- CVE-2026-89994In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-89996In the Linux kernel, the following vulnerability has been re…
- CVE-2026-89997In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-89998In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-89999In the Linux kernel, the following vulnerability has been re…8.1
- CVE-2026-90000In the Linux kernel, the following vulnerability has been re…8.8
- CVE-2026-90001In the Linux kernel, the following vulnerability has been re…7.8
Are you affected by CVE-2026-89995?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST